Attacker can steal the locked NFT in protocol because of lacking check in function borrowToBuy()

Lines of code Vulnerability details Impact In function borrowToBuy, the borrower takes a loan offer and uses the funds to purchase NFT. / Take the loan offer. / takeLoanOfferoffer, signature, lienId, loanAmount, collateralTokenId; / Lock token. / offer.collection.transferFrommsg.sender,...

WPunk will become locked if liquidator ops to receive the underlying token instead of nToken

Lines of code Vulnerability details Impact WPunks received directly as the result of liquidation will be unable to be withdrawn Proof of Concept function withdrawPunkuint256 calldata punkIndexes, address to external nonReentrant INToken nWPunk = INToken Pool.getReserveDataaddressWPunk.xTokenAddre...

AN ATTACKER CAN CREATE A SHORT PUT OPTION ORDER ON AN NFT THAT DOES NOT SUPPORT ERC721 (LIKE CRYPTOPUNK), AND THE USER CAN FULFILL THE ORDER, BUT CANNOT EXERCISE THE OPTION

Lines of code Vulnerability details Impact Blur is kind of NFT marketplace where will somehow attracts high value NFT items like cryptopunk. Therefore assuming the platform will handle cryptopunk NFT is a common thing, and this raise an issue. An attacker can create a short put option on...